Correlating distinct events using linguistic analysis

ABSTRACT

Linguistic analysis based correlation of distinct events is provided. In examples, trouble shooting tickets may be received over a time period. A linguistic analysis may be performed on one or more portions of the one or more comments using a linguistic model and a similarity score may be computed for one or more keywords within the one or more portions of the one or more comments based on criteria associated with each of the keywords. The similarity score for each of the keywords may be compared to a validation threshold and if the similarity score for a subset of the keywords within a trouble shooting ticket exceeds the validation threshold, the trouble shooting ticket may be validated as associated with the incident. If a number of trouble shooting tickets are validated as being associated with the incident exceeds a service outage threshold, an alert may be issued for the service outage.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation under 35 U.S.C. § 120 of co-pendingU.S. patent application Ser. No. 15/131,051 filed on Apr. 18, 2016. Thedisclosure of the U.S. Patent Application is hereby incorporated byreference in its entirety.

BACKGROUND

Information technology services facilitate the use of technology andprovide specialized technology-oriented solutions to end users andenterprises through combining processes and functions of hardware,software, networks, and telecommunications. In some examples, the endusers may encounter problems related to a service or a product. The endusers may contact the information technology services to addressproblems or submit requests related to the service or the product. Thecontact may include a submission of a ticket, for example. Technicalsupport personnel may label each ticket as being related to a problem oran incident. In other examples, the technical support personnel maymanually add comments or feedback to the ticket to specify the problemor the request the end user is concerned with.

However, the manual assignment of the ticket to the problem/the incidentmay be time-consuming, as an accurate and automatic process to map thesemetrics in near-real time does not exist. Further, in some examples, twotechnical support personnel may utilize varying keywords in the commentswhen discussing the same incident, making the classification of theticket to the incident difficult.

SUMMARY

This summary is provided to introduce a selection of concepts in asimplified form that are further described below in the DetailedDescription. This summary is not intended to exclusively identify keyfeatures or essential features of the claimed subject matter, nor is itintended as an aid in determining the scope of the claimed subjectmatter.

Embodiments are directed to linguistic analysis based incidence/serviceoutage detection. In some examples, a communication such as a troubleshooting ticket associated with an incident may be received, where thetrouble shooting ticket includes a comment. A linguistic analysis may beperformed on a portion of the comment, where the linguistic analysis mayinclude determining a parameter associated with a similarity of akeyword within the portion of the comment to a predefined keyword andvalidating the trouble shooting ticket as associated with the incidentthrough a decision process based on the parameter. Multiple troubleshooting tickets may be analyzed employing the decision process. Analert may be issued for the service outage in response to determiningthat a number of trouble shooting tickets validated as associated withthe incident exceeding a service outage threshold.

These and other features and advantages will be apparent from a readingof the following detailed description and a review of the associateddrawings. It is to be understood that both the foregoing generaldescription and the following detailed description are explanatory anddo not restrict aspects as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a conceptual diagram illustrating an example computingenvironment for linguistic analysis based correlation of distinctevents, according to embodiments;

FIG. 2 is a display diagram illustrating an example communication withcomments received at a server, according to embodiments, according toembodiments;

FIG. 3 is a display diagram illustrating performance of a linguisticanalysis on comments to extract keywords associated with each of thecomments and computing a similarity score for each of the keywords,according to embodiments;

FIG. 4 is a display diagram illustrating performance of a linguisticanalysis on a comment to extract keywords from the comment, identifyingcontextually-related keywords from the comment, and identifyingmisspelled keywords associated with the comment, according toembodiments;

FIG. 5 is a simplified networked environment, where a system accordingto embodiments may be implemented;

FIG. 6 is a block diagram of an example computing device, which may beused for linguistic analysis based correlation of distinct events,according to embodiments; and

FIG. 7 is a logic flow diagram illustrating a process for linguisticanalysis based correlation of distinct events, according to embodiments.

DETAILED DESCRIPTION

As briefly described above, embodiments are directed to linguisticanalysis based correlation of distinct events. In some examples, alinguistic analysis may be performed on one or more portions of acomment associated with an incident. A similarity score may be computedfor keywords related within the comments based on criteria associatedwith one or more of the keywords. The similarity score for the keywordsmay be compared to a threshold. In response to detecting the similarityscore for a subset of the keywords exceeding the threshold, acommunication that includes the comment may be identified and anassociation between the communication and the incident may be validated.

In some examples, the criteria associated with the keywords may includea first criterion associated with a frequency of contextually-relatedkeywords in the comment and/or a second criterion associated with ausage frequency in the comment, among other criteria. Analyzed portionsof the comment may include a sentence or a paragraph in the comment. Inadditional examples, an analysis service may be configured to assign afirst weighted value to the first criterion, assign a second weightedvalue to the second criterion, and compare the first weighted value tothe second weighted value. In other examples, the analysis service maydetect the first weighted value as being greater than the secondweighted value and may compute the similarity score for keywords relatedwithin the comment based on the first criterion associated with thekeywords. In further examples, the analysis service may detect the firstweighted value as being less than the second weighted value and maysubsequently compute the similarity score for the keywords relatedwithin the comment based on the second criterion associated with thekeywords.

In other examples, trouble shooting tickets in the process of beingcreated may be monitored and linguistic analysis may be performed on aninitial portion of a ticket being created (in form of a web form beingfilled out, an email being sent, etc.). Upon performance of the incidentassociation validation (and optionally service outage detection), thecreator of the ticket may be presented with potential solutions and/orsuitable people (e.g., administrators, service personnel, etc.) may bealerted prior to the ticket being completed.

In further examples, a support service may present a user that enters adescription of a problem with a number of potentially applicablearticles or comparable documents. However, in conventional systems, asuccess rate of such presented documents may not be quantitativelydeterminable (e.g., did the user find an article useful, did they findanother solution, did they give up on the solution) except for userfeedback. In one implementation of a system as described herein, alinguistic analysis may be performed on the presented documents. Thedocuments may be selected based on a search prioritization (e.g.,keywords). A user action following presentation of the documents andresults of the linguistic analysis may then be used to make an inferenceon the usefulness of the presented documents. For example, the user'saction may include creation of a ticket, leaving the support system,etc. If a presented document has a high similarity score, but the userstill created a ticket, the inference may be that the content of thedocument was insufficient to address the problem. On the other hand, ifthe document's similarity score is low and the user still created aticket, the inference may be that the document was irrelevant to theuser's problem.

In conjunction with embodiments such as the solutionrelevancy/effectiveness determination described above, various machinelearning algorithms may be employed. Some of those may includealgorithms that have multiple non-linear layers and can learn featurehierarchies also referred to as “Deep Learning” algorithms. In deeplearning systems, algorithms may automatically learn featurehierarchies, which represent objects in increasing levels ofabstraction. Deep learning algorithms may be categorized by theirarchitecture (e.g., feed-forward, feed-back, or bi-directional) andtraining protocols (e.g., purely supervised, hybrid, or unsupervised).

In the following detailed description, references are made to theaccompanying drawings that form a part hereof, and in which are shown byway of illustrations, specific embodiments, or examples. These aspectsmay be combined, other aspects may be utilized, and structural changesmay be made without departing from the spirit or scope of the presentdisclosure. The following detailed description is therefore not to betaken in a limiting sense, and the scope of the present disclosure isdefined by the appended claims and their equivalents.

While some embodiments will be described in the general context ofprogram modules that execute in conjunction with an application programthat runs on an operating system on a personal computer, those skilledin the art will recognize that aspects may also be implemented incombination with other program modules.

Generally, program modules include routines, programs, components, datastructures, and other types of structures that perform particular tasksor implement particular abstract data types. Moreover, those skilled inthe art will appreciate that embodiments may be practiced with othercomputer system configurations, including hand-held devices,multiprocessor systems, microprocessor-based or programmable consumerelectronics, minicomputers, mainframe computers, and comparablecomputing devices. Embodiments may also be practiced in distributedcomputing environments where tasks are performed by remote processingdevices that are linked through a communications network. In adistributed computing environment, program modules may be located inboth local and remote memory storage devices.

Some embodiments may be implemented as a computer-implemented process(method), a computing system, or as an article of manufacture, such as acomputer program product or computer readable media. The computerprogram product may be a computer storage medium readable by a computersystem and encoding a computer program that comprises instructions forcausing a computer or computing system to perform example process(es).The computer-readable storage medium is a computer-readable memorydevice. The computer-readable storage medium can for example beimplemented via one or more of a volatile computer memory, anon-volatile memory, a hard drive, a flash drive, a floppy disk, or acompact disk, and comparable hardware media.

Throughout this specification, the term “platform” may be a combinationof software and hardware components for linguistic analysis basedcorrelation of distinct events. Examples of platforms include, but arenot limited to, a hosted service executed over a plurality of servers,an application executed on a single computing device, and comparablesystems. The term “server” generally refers to a computing deviceexecuting one or more software programs typically in a networkedenvironment. More detail on these technologies and example operations isprovided below.

A computing device, as used herein, refers to a device comprising atleast a memory and one or more processors that includes a server, adesktop computer, a laptop computer, a tablet computer, a smart phone, avehicle mount computer, or a wearable computer. A memory may be aremovable or non-removable component of a computing device configured tostore one or more instructions to be executed by one or more processors.A processor may be a component of a computing device coupled to a memoryand configured to execute programs in conjunction with instructionsstored by the memory. Actions or operations described herein may beexecuted on a single processor, on multiple processors (in a singlemachine or distributed over multiple machines), or on one or more coresof a multi-core processor. An operating system is a system configured tomanage hardware and software components of a computing device thatprovides common services and applications. An integrated module is acomponent of an application or service that is integrated within theapplication or service such that the application or service isconfigured to execute the component. A computer-readable memory deviceis a physical computer-readable storage medium implemented via one ormore of a volatile computer memory, a non-volatile memory, a hard drive,a flash drive, a floppy disk, or a compact disk, and comparable hardwaremedia that includes instructions thereon to automatically save contentto a location. A user experience—a visual display associated with anapplication or service through which a user interacts with theapplication or service. A user action refers to an interaction between auser and a user experience of an application or a user experienceprovided by a service that includes one of touch input, gesture input,voice command, eye tracking, gyroscopic input, pen input, mouse input,and keyboards input. An application programming interface (API) may be aset of routines, protocols, and tools for an application or service thatallow the application or service to interact or communicate with one ormore other applications and services managed by separate entities.

While example implementations are described using communications herein,embodiments are not limited to communication data. Linguistic analysisbased correlation of distinct events may be implemented in otherenvironments, such as research environments, information technologyenvironments, healthcare environments, educational environments,application sharing environments, online conferencing environments, andsimilar environments, where communication data may be exchanged. Furtherexamples may include detecting customer impact on service health alerts.

The technical advantages of linguistic analysis based correlation ofdistinct events may include, among others, an increased accuracy, anincreased automation, and a decreased processing time for the assignmentof the communication to the incident. For example, a linguistic analysismay be performed on a section of comments associated with thecommunications. Similarity scores may be computed for each keywordrelated within the section of the comments based on criteria associatedwith one or more of the keywords. The use of the linguistic analysis mayalso reduce processing and network bandwidth usage. Further, the use ofthe linguistic analysis may reduce human error in the assignment of thecommunication to the incident.

Embodiments address a need that arises from very large scale ofoperations created by networked computing and cloud based services thatcannot be managed by humans. The actions/operations described herein arenot a mere use of a computer, but address results of a system that is adirect consequence of software used as a service such as communicationservices offered in conjunction with communications.

FIG. 1 is a conceptual diagram illustrating an example computingenvironment for linguistic analysis based correlation of distinctevents, according to embodiments.

As shown in a diagram 100, a server 108 may execute an analysis service110. The server 108 may include a web server or a document server, amongothers. The analysis service 110 may receive a communication from aparticipant 106 (e.g., an end-user, a technical support personnel, etc.)associated with a computing device 102. Examples of the communicationmay include an instant messaging communication, a textual communication,an email communication, a text message communication, an audio messagingcommunication, a video messaging communication, and/or a graphicalmessaging communication, among other forms of communication.

The computing device 102 may communicate with the server 108 through anetwork 104. The computing device 102 may be a desktop computer, alaptop computer, a tablet, a handheld device, a vehicle mount computer,an embedded computer system, a smart phone, or a wearable computer,among other similar computing devices, for example. The network 104 mayprovide wired or wireless communications between nodes, such as thecomputing device 102 or the server 108.

An engine or module (e.g., a processing engine or an analysis engine,for example) of the server 108 may present configuration options on auser experience to the participant 106. The user experience may be avisual display associated with the analysis service 110 through whichthe participant 106 may interact with the analysis service 110. Theinteractions may include a touch input, a gesture input, a voicecommand, eye tracking, a gyroscopic input, a pen input, mouse input,and/or a keyboards input, among others.

The communication may be associated with an incident. The incident maybe broadly defined as an abnormal event that is not part of a standardoperation of the analysis service 110. In an example, the incident maycause an interruption or a reduction in quality of a product or aservice produced by the analysis service 110. In some examples, theincident may include a failure or an error associated with softwareinfrastructure, the network 104, hardware, and/or software. In someexamples, the communication may include comments. The comments may befeedback provided by the participant 106 (e.g., the end user, thetechnical support personnel, etc.).

The analysis service 110 may also be configured to perform a linguisticanalysis on a section of the comments or an entirety of the comments.The analysis service 110 may also compute a similarity score for eachkeyword related within the section of the comments based on criteriaassociated with the keywords. The similarity score may be a similaritymeasure or a real-valued similarity function that quantitativelymeasures a likeness between the keywords related within the section ofthe comments.

The analysis service 110 may then compare the similarity score for thekeywords to a threshold. The threshold may include a timing thresholdand/or an urgency threshold associated with the incident. In response todetecting the similarity score for a subset of the keywords exceedingthe threshold, the analysis service 110 may identify the communicationthat includes the comments and may validate an association between thecommunication and the incident.

The analysis service 110 may implement the process steps described innumerous fields to validate the association between the communicationand the incident, such as, the information technology field, theresearch field, the educational field, and/or the healthcare field,among other examples. In the information technology field, an examplecommunication may include an end-user feedback (e.g., an email feedback)and an example incident may include a service outage in a cloud-basedservice.

In the research field, the example communication may include the textualcommunication (e.g., an email feedback) submitted by a studentresearcher. The example incident may include a service outage associatedwith a national cloud-based computing center (e.g., the NationalInstitute for Computational Sciences). In the educational field, theexample communication may include the textual communication (e.g., anemail communication or a press release) submitted by a professor to aninformation technology department at a college. The example incident mayinclude errors associated with a web-based learning management system(LMS) designed to support online courses or provide a space forface-to-face course supplementation.

In the healthcare field, the example communication may include an audioalert. The audio alert may occur in response to a hospital patientpressing a push button to call a nurse or a doctor. In response topressing the push button, the audio alert may sound in the patients'hospital room. The example incident may include the patient having aproblem breathing.

While the example system in FIG. 1 has been described with specificcomponents including the server 108, the analysis service 110, and thecomputing device 102, embodiments are not limited to these components orsystem configurations and can be implemented with other systemconfiguration employing fewer or additional components.

FIG. 2 is a display diagram illustrating an example communication withcomments received at a server, according to embodiments.

As shown in a diagram 200, a server 218 may execute an analysis service210. The server 218 may include a web server or a document server, amongothers. The analysis service 210 may include a processing engine 212 andan analysis engine 220, among others. The processing engine 212 mayreceive a communication 202 and another communication 204 from aparticipant 216 associated with a computing device 214. The computingdevice 214 may communicate with the server 218 through a network.

The communication 202 may include a comment 206. The other communication204 may include another comment 208. In some examples, the participant216 (e.g., an end-user) may draft the comment 206 and the other comment208. In other examples, subsequent receipt of the communication 202 andthe other communication 204, the analysis service 210 may prompt thetechnical support personnel (e.g., engineers, program managers, orescalation engineers, etc.) to draft the comment 206 and the othercomment 208. In further examples, the participant 216 may draft thecomment 206 associated with the communication 202. Subsequent receipt ofthe other communication 204, the analysis service 210 may prompt thetechnical support personnel to draft the other comment 208.

The processing engine 212 may present configuration options on a userexperience to the participant 216. The configuration options may includea modification of the communication 202, a modification of the othercommunication 204, a modification of the comment 206, and/or amodification of the other comment 208. The user experience may be avisual display associated with the analysis service 210 through whichthe participant 216 may interact with the analysis service 210. Theinteractions may include a touch input, a gesture input, a voicecommand, eye tracking, a gyroscopic input, a pen input, mouse input,and/or a keyboards input, among others.

The communication 202 and the other communication 204 may be associatedwith incidences. In an example, the comment 206 may express the concernthat the participant 216 is operating a cell phone, cannot log into hisemail, and cannot access his calendar appointments. The other comment208 may express the concern that the participant 216 is having troublewith enterprise application software (EAS) on his cell phone. The othercomment 208 may also express the concern that access to the calendartasks on the participants' cell phone is very slow. Both the comment 206and the other comment 208 are related to the participant 216 operatingthe cell phone and having difficulties accessing calendar tasks orappointments, yet the comment 206 and the other comment 208 usedifferent keywords to express similar concerns.

In other examples, the comment 206 and the other comment 208 may usesimilar keywords to express different concerns aimed at differentincidences. For example, the comment 206 may disclose that theparticipant 216 has recently changed his password and cannot access hisemail on his cell phone. The other comment 208 may disclose that theparticipants' email is loading slowly and he cannot access his email onhis cell phone. Though the comment 206 and the other comment 208 usesimilar keywords, such as, “cell phone,” “email,” and “access,” thecomment 206 is associated with an inability to access the email on hiscell phone subsequent an edit of the participants' password. The othercomment 208 is associated with the inability to access the email on hiscell phone due to a slow connection.

To remedy the manual classification and association of the communication202 and the other communication 204 to the incidences, the analysisengine 220 may be configured to perform a linguistic analysis on asection of the comment 206 and the other comment 208. The section mayinclude a sentence, a paragraph, or a participant-defined section of thecomment 206 or the other comment 208. The analysis engine 220 may alsocompute a similarity score for each keyword related within the sectionof the comment 206 and the other comment 208 based on criteriaassociated with the keywords. The similarity score may determine aquantitative similarity/likeness measure for each keyword.

Various methods may be used to determine the similarity score. A firstmethod, Term Frequency-Inverse Document Frequency (TF-IDF), is anumerical statistic that identifies how important each keyword is to thedocument it is included in. TF-IDF has been used in informationretrieval and text mining, for example. In the TF-IDF method, the valueof a keyword increases proportionally to the number of times the keywordappears in the document, but is offset by the frequency of the keywordin the document, which helps to adjust for the fact that some keywordsappear more frequently in general.

Another method that may be used to determine the similarity score mayinclude statistical language models. The statistical language models mayassign probability distributions over sequences of keywords. Forexample, with a sequence of keywords of a length m, a statisticallanguage model may assign a probability of P(w₁, . . . , w_(m)) to thewhole sequence. Having a way to estimate the relative likelihood ofdifferent phrases may be useful in natural language processingapplications, such as speech recognition, machine translation,part-of-speech tagging, parsing, handwriting recognition, andinformation retrieval, among other applications.

The analysis engine 220 may also compare the similarity score for thekeywords to a threshold. The threshold may include a timing threshold(e.g., a twenty-four hour threshold, an hour threshold, or a ten minutethreshold, etc.) and/or an urgency threshold associated with theincident. In some examples, the urgency threshold may beparticipant-defined or may be system-dependent.

In response to detecting the similarity score for a subset of thekeywords exceeding the threshold, the analysis engine 220 may identify aselect communication (e.g., the communication 202) that includes thecomment 206 and may validate an association between the communication202 and the incident.

FIG. 3 is a display diagram illustrating performance of a linguisticanalysis on comments to extract keywords associated with each of thecomments and computing a similarity score for the keywords, according toembodiments.

As shown in a diagram 300, a server 318 may execute an analysis service320. The analysis service 320 may receive a communication 302 andanother communication 304 from a participant. The communication 302 mayinclude a comment 306. The other communication 304 may include a comment308. In an example, the communication 302 and the other communication304 may be associated with the same incident. In other examples, thecommunication 302 and the other communication 304 may be associated withdifferent incidences.

In an example, the comment 306 may express the concern that theparticipant is operating a cell phone, cannot log into his email, andcannot access his calendar appointments. The comment 306 may includekeywords 310 such as, “cell phone” 311, “email,” “access,” “calendar,”and “appointment.” The comment 308 may express the concern that theparticipant is having trouble with enterprise application software (EAS)on his cell phone. The comment 308 may also disclose that theparticipant's access to the calendar tasks on his cell phone is veryslow. The comment 308 may include the keywords 314 such as, “EAS,”“access,” “calendar,” “tasks,” and “cell phone 315.” Both the comment306 and the comment 308 are related to the participant operating thecell phone and having difficulties accessing calendar tasks orappointments, yet the comment 306 and the comment 308 may use differentkeywords to express similar concerns.

The analysis service 320 may be configured to perform a linguisticanalysis on a section of the comment 306. The section of the comment 306may include a sentence in the comment 306, a paragraph in the comment306, and/or a participant-defined area in the comment 306, among others.In some examples, the analysis service 320 may be configured to performa linguistic analysis on the entirety of the comment 306 and/or theentirety of the comment 308.

The analysis service 320 may also compute a similarity score 312 foreach keyword related within the section of the comment 306 based oncriteria associated with the keywords 310. One or more machine learningalgorithms may be used to determine the keywords 310 related during atime period. For example, during a first time period, the keywords 310,“mailbox,” “archive,” and “account,” may be associated within thecomment 306 more often than not (e.g., six out of ten sampling times,seven out of ten sampling times, eight out of ten sampling times, etc.).The analysis service 320 may determine that the keywords 310, “mailbox,”“archive,” and “account” are related during a second time period.

The machine learning techniques may include pattern recognition andcomputational learning theory, among others. The machine learningalgorithms may learn and make predictions on the communication data ofthe communication 302 and the other communication 304. Common machinelearning algorithms may include supervised learning algorithms,unsupervised learning algorithms, and reinforcement learning algorithms.Some of the machine learning algorithms may include linear regressionalgorithms, logistic regression algorithms, decision tree algorithms,support vector machine (SVM) algorithms, Naive Bayes algorithms, aK-nearest neighbors (KNN) algorithm, a K-means algorithm, a randomforest algorithm, dimensionality reduction algorithms, and a GradientBoost & Adaboost algorithm, among others.

The supervised learning algorithms may use a dependent variable which isto be predicted from a given set of independent variables. Using theindependent variables, a function may be generated that may map inputsto desired outputs. The training process may continue until the modelachieves a desired level of accuracy on the training data. Examples ofthe supervised learning algorithms may include a regression learningalgorithm, a decision tree learning algorithm, a random forest learningalgorithm, a k-nearest neighbors algorithm, and a logistic regressionalgorithm, among others.

The unsupervised learning algorithms do not have outcome variables topredict/estimate, but the unsupervised learning algorithms may be usedfor clustering populations (e.g., the keywords) in different groups.Examples of the unsupervised learning algorithms may include an apriorialgorithm and a K-means algorithm, among others. An examplereinforcement learning algorithm may include the Markov decision processalgorithm.

In some examples, the criteria associated with the keywords may includea first criterion associated with a frequency of contextually-relatedkeywords in the section of the comment 306 and/or a second criterionassociated with a usage frequency in the section of the comment 306. Thesimilarity score 312 may determine a quantitative similarity/likenessmeasure for each keyword.

In an example, the analysis service 320 may perform the linguisticanalysis on the entirety of the comment 306. The analysis service 320may compute the similarity score 312 for the keywords related within theentirety the comment 306 based on the second criterion (e.g., the usagefrequency in the section of the comment 306). In the example, as thekeyword, “cell phone” 311 appears twice within the entirety of thecomment 306, the analysis service 320 may compute the highest similarityscore for the keyword, “cell phone” 311.

In another example, the analysis service 320 may assign a first weightedvalue (e.g., a weighted value of two) to the first criterion and mayassign a second weighted value (e.g., a weighted value of one) to thesecond criterion. The analysis service 320 may compare the firstweighted value to the second weighted value. The analysis service 320may detect the first weighted value as being greater than the secondweighted value and may then compute the similarity score 312 for eachkeyword related within the section of the comment based on the firstcriterion associated with the keywords.

In other examples, the analysis service 320 may assign a first weightedvalue (e.g., a weighted value of one) to the first criterion and mayassign a second weighted value (e.g., a weighted value of three) to thesecond criterion. The analysis service 320 may compare the firstweighted value to the second weighted value. The analysis service 320may detect the first weighted value as being less than the secondweighted value and may then compute the similarity score 312 for eachkeyword related within the section of the comment based on the secondcriterion associated with the keywords.

In further examples, the analysis service 320 may receive a request froma requesting party to modify the assignment of one the first weightedvalue to the first criterion and the second weighted value to the secondcriterion. The analysis service 320 may identify a credential associatedwith the requesting party and may compare the credential to a predefinedrule. In response to detecting a match between the credential and thepredefined rule, the analysis service 320 may identify the requestingparty as an administrator and may provide an alert to be displayed on auser experience to the requesting party to prompt the requesting partyto modify the assignment associated with the first weighted value and/orthe second weighted value. The alert may include an audio alert, avisual alert, a tactile alert, and/or a textual alert, among others. Theanalysis service 320 may then receive the modification of the assignmentfrom the requesting party and may then execute modification of theassignment.

The analysis service 320 may also compare the similarity score 312 forthe keywords to a threshold. The threshold may include a timingthreshold (e.g., a twenty-four hour threshold, an hour threshold, or aten minute threshold, etc.) and/or an urgency threshold associated withthe incident. In some examples, the urgency threshold may beparticipant-defined (e.g., may be based on a task or appointment set bythe participant). In response to detecting the similarity score 312 fora subset of the keywords exceeding the threshold, the analysis service320 may identify a select communication (e.g., the communication 302)that includes the comment and may validate an association between thecommunication 302 and the incident.

FIG. 4 is a display diagram illustrating performance of a linguisticanalysis on a comment to extract keywords from the comment, identifyingcontextually-related keywords from the comment, and identifyingmisspelled keywords associated with the comment, according toembodiments.

As shown in a diagram 400, a server 404 may execute an analysis service408. The analysis service 408 may receive a communication 402 from aparticipant. The communication 402 may include a comment 406. In anexample, the communication 402 may be associated with an incident. Theanalysis service 408 may be configured to perform a linguistic analysison a section of the comment 406. The section of the comment 406 mayinclude a sentence in the comment 406, a paragraph in the comment 406,and/or a participant-defined area in the comment 406, among others.

The analysis service 408 may also compute a similarity score 412 foreach keyword related within the section of the comment 406 based oncriteria associated with the keywords 410. The criteria associated withthe keywords 410 may include a first criterion associated with afrequency of contextually-related keywords in the section of the comment406 and/or a second criterion associated with a usage frequency in thesection of the comment 406. The similarity score 412 may determine aquantitative similarity/likeness measure for the keywords 410.

In an example, the analysis service 408 may perform the linguisticanalysis on the entirety of the comment 406. The analysis service 408may compute the similarity score 412 for the keywords 410 related withinthe entirety the comment 406 based on the second criterion (e.g., theusage frequency in the section of the comment 406). In the example, thekeyword, “cell phone,” appears twice within the entirety of the comment406. As such, he keyword, “cell phone,” will have the highest similarityscore 412.

In another example, the analysis service 408 may perform the linguisticanalysis on the entirety of the comment 406. The analysis service 408may compute the similarity score 412 for the keywords 410 related withinthe entirety the comment 406 based on the first criterion (e.g., thefrequency of contextually-related keywords 418 in the section of thecomment 406) using natural language processing algorithms, machinelearning algorithms, and/or statistical machine learning algorithms,among others.

The analysis service 408 may identify keywords 410 that arecontextually-related to the keywords, “email” 411, for example. Thecontextually-related keywords 418 may include the keywords, “mailbox,”“box,” “archive,” “account,” and “mail.” In other examples, the analysisservice 408 may identify keywords 410 that are contextually-related tothe term, “mailbox.” The contextually-related keywords 418 may includethe keywords 410, “account,” “archive,” “calendar,” and “user.” Infurther examples, the analysis service 408 may identify keywords 410that are contextually-related to the term, “delay.” Thecontextually-related keywords 418 may include the keywords 410,“delaying,” “delays,” “arriving,” “received,” “occasional,” and “held.”

In some other examples, the analysis service 408 may identify keywords410 that are contextually-related to the term, “access.” Thecontextually-related keywords 418 may include the keywords 410,“permission,” “granted,” “privileges,” “rights,” “contribute,” and“lockdown.” In additional examples, the analysis service 408 mayidentify keywords 410 that are contextually-related to the term, “EAS.”The contextually-related keywords 418 may include the keywords 410,“protocol,” “information correlation,” “cellular,” “cell,” and “mobile.”

In other examples, the analysis service 408 may also analyze a historyof computed similarity scores for keywords 410 contextually related tothe term, “email” 411 during a previous time period using one or moremachine learning algorithms. The analysis service 408 may identify thecontextually-related keywords 418 during the previous time period, whichmay include the keywords, “mailbox,” “box,” “archive,” and “account,”may be associated within the comment 406 more often than not (e.g., sixout of ten sampling times, seven out of ten sampling times, eight out often sampling times, etc.). The analysis service 408 may determine thatthe keywords, “mailbox,” “archive,” and “account” are related during asecond time period. Additionally, the analysis service 408 may alsoidentify misspelled contextually-related keywords 421-423 during theprevious time period. The misspelled contextually-related keywords421-423 may include the keywords such as, “emaail” 421, “emali” 422,”and “emaill” 423.

The analysis service 408 may also compare the similarity score 412 forthe keywords 410 to a threshold. The threshold may include a timingthreshold (e.g., a twenty-four hour threshold, an hour threshold, or aten minute threshold, etc.) and/or an urgency threshold associated withthe incident. In some examples, the urgency threshold may beparticipant-defined (e.g., may be based on a task or appointment set bythe participant). In response to detecting the similarity score 412 fora subset of the keywords 410 exceeding the threshold, the analysisservice 408 may identify the communication 402 including the comment 406and may validate an association between the communication 402 and theincident.

In other examples, the analysis service 408 may receive a request from arequesting party (e.g., the participant or a technical personnel) tomodify the assignment of the communication 402 from the incident toanother incident. The analysis service 408 may identify a credentialassociated with the requesting party and may compare the credential to apredefined rule. In some examples, the analysis service 408 may detect amatch between the credential and the predefined rule and may identifythe requesting party as an administrator (e.g., the technicalpersonnel). The analysis service 408 may provide an alert to bedisplayed on a user experience to the requesting party to prompt therequesting party to modify the assignment of the communication 402 fromthe incident to the other incident. The alert may include an audioalert, a visual alert, a tactile alert, and/or a textual alert, amongothers. The analysis service 408 may receive the modification of theassignment from the requesting party and may execute the modification ofthe assignment.

In other examples, the analysis service 408 may detect a mismatchbetween the credential and the predefined rule and may identify therequesting party as the participant (e.g., an end-user). The analysisservice 408 may then provide the alert to be displayed on the userexperience to the participant to indicate a persistence of theassociation between the communication 402 and the incident.

In other examples, the analysis service 408 may compare the similarityscore 412 for the keywords 410 to another threshold and may detect thesimilarity score 412 for the keywords 410 as exceeding the otherthreshold. The analysis service 408 may then identify the comment 406associated with the similarity score 412 for the keywords 410 asexceeding the other threshold.

The analysis service 408 may then identify the communication 402 thatincludes the comment 406. In some examples, the analysis service 408 maydetect a failure to validate an association between the communication402 and the incident. In response, the analysis service 408 may analyzea history of associations of the communication 402 to the incident andother incidents during a previous time period and may assign thecommunication 402 to another incident based on the analysis.

In other examples, the analysis service 408 may utilize thecontextually-related keywords 418 to retrain the model associated withthe linguistic analysis. The analysis service 408 may allow theadministrator to adjust individual similarity scores. The analysisservice 408 may also allow the administrator to provide feedback and/orcomments to the analysis service 408 to re-validate and/or re-train thelinguistic analysis model.

FIG. 5 is a simplified networked environment, where a system accordingto embodiments may be implemented.

As shown in a diagram 500, a server include an analysis service. Theanalysis service may be implemented in a networked environment over oneor more networks, such as a network 510. An engine or module (e.g., aprocessing engine or an analysis engine, for example) of the server maypresent configuration options on a user experience to a participant. Theuser experience may be a visual display associated with the analysisservice through which the participant may interact with the analysisservice. The interactions may include a touch input, a gesture input, avoice command, eye tracking, a gyroscopic input, a pen input, mouseinput, and/or a keyboards input, among others.

The analysis service, as discussed herein, may be implemented viasoftware executed over servers 515. The servers 515 may include one ormore processing servers 516, where at least one of the one or moreprocessing servers 516 may be configured to execute one or moreapplications associated with the analysis service. In other examples,the analysis service may be provided by a third party service or mayinclude a web application. The analysis service may store data in a datastore 519 directly or through a database server 518.

In examples, the servers 515 may include the analysis service. Theanalysis service may include a processing engine and an analysis engine.The processing engine may be configured to receive a communicationassociated with an incident from the participant. The participant may beassociated with a computing device (e.g., a desktop computer 511, amobile computer 512, or a smart phone 513, among other computingdevices). The communication may include comments. A textual scheme, agraphical scheme, an audio scheme, an animation scheme, a coloringscheme, a highlighting scheme, and/or a shading scheme may be employedto distinguish the comments.

The analysis engine may be configured to perform a linguistic analysison a section of the comments, compute a similarity score for eachkeyword related within the section of the comments based on criteriaassociated with the keywords, and compare the similarity score for thekeywords to a threshold. In response to detecting the similarity scorefor a subset of the keywords exceeding the threshold, the analysisengine may be further configured to identify the communication thatincludes the comments and may validate an association between thecommunication and the incident.

The computing device may communicate with the server over a network 510.The network 510 may comprise any topology of servers, clients, Internetservice providers, and communication media. A system according toembodiments may have a static or dynamic topology. The network 510 mayinclude multiple secure networks, such as an enterprise network, anunsecure network, or the Internet. The unsecure network may include awireless open network. The network 510 may also coordinate communicationover other networks, such as Public Switched Telephone Network (PSTN) orcellular networks. Furthermore, the network 510 may include multipleshort-range wireless networks, such as Bluetooth, or similar ones. Thenetwork 510 may provide communication between the nodes describedherein. By way of example, and not limitation, the network 510 mayinclude wireless media. The wireless media may include, among others,acoustic media, RF media, infrared media, and other wireless media.

Many other configurations of computing devices, applications, andsystems may be employed for assigning a communication to an incident.Furthermore, the networked environments discussed in FIG. 5 are forillustration purposes only. Embodiments are not limited to the exampleapplications, modules, or processes.

FIG. 6 is a block diagram of an example computing device, which may beused for linguistic analysis based correlation of distinct events,according to embodiments.

As shown in an example basic configuration 602, a computing device 600may be used as a server, a desktop computer, a portable computer, asmart phone, a special purpose computer, or a similar device. In anexample basic configuration 602, the computing device 600 may includeone or more processors 604 and a system memory 606. A memory bus 608 maybe used for communication between the processor 604 and the systemmemory 606. The example basic configuration 602 may be illustrated inFIG. 6 by those components within the inner dashed line.

Depending on the desired configuration, the processor 604 may be of anytype, including but not limited to a microprocessor (μP), amicrocontroller (μC), a digital signal processor (DSP), or anycombination thereof. The processor 604 may include one more levels ofcaching, such as a level cache memory 612, one or more processor cores614, and registers 616. The one or more processor cores 614 may (each)include an arithmetic logic unit (ALU), a floating point unit (FPU), adigital signal processing core (DSP Core), or any combination thereof.An example memory controller 618 may also be used with the processor604, or in some implementations, the example memory controller 618 maybe an internal part of the processor 604.

Depending on the desired configuration, the system memory 606 may be ofany type including but not limited to volatile memory (such as RAM),non-volatile memory (such as ROM, flash memory, etc.), or anycombination thereof. The system memory 606 may include an operatingsystem 620, an analysis service 622, and a program data 624. Theanalysis service 622 may include a processing engine 626, and ananalysis engine 627. The processing engine 626 may be configured toreceive a communication associated with an incident from a participant.The communication may include comments. The analysis engine 627 may beconfigured to perform a linguistic analysis on a section of the one ormore comments, compute a similarity score for each keyword relatedwithin the section of the comments based on criteria associated with thekeywords, and compare the similarity score for the keywords to athreshold. In response to detecting the similarity score for a subset ofthe keywords exceeding the threshold, the analysis engine 627 may befurther configured to identify the communication that includes thecomments and validate an association between the communication and theincident. The program data 624 may also include, among other data,similarity score data, keyword data, association data, and otherinformation data related to the association between the communicationand the incident, or the like, as described herein.

The computing device 600 may have additional features or functionality,and additional interfaces to facilitate communications between theexample basic configuration 602 and any desired devices and interfaces.For example, a bus/interface controller 630 may be used to facilitatecommunications between the example basic configuration 602 and one ormore data storage devices 632 via a storage interface bus 634. The datastorage devices 632 may be one or more removable storage devices 636,one or more non-removable storage devices 638, or a combination thereof.Examples of the removable storage and the non-removable storage devicesmay include magnetic disk devices, such as flexible disk drives andhard-disk drives (HDD), optical disk drives such as compact disk (CD)drives or digital versatile disk (DVD) drives, solid state drives (SSD),and tape drives, to name a few. Example computer storage media mayinclude volatile and nonvolatile, removable, and non-removable mediaimplemented in any method or technology for storage of information, suchas computer-readable instructions, data structures, program modules, orother data.

The system memory 606, the removable storage devices 636 and thenon-removable storage devices 638 are examples of computer storagemedia. Computer storage media includes, but is not limited to, RAM, ROM,EEPROM, flash memory or other memory technology, CD-ROM, digitalversatile disks (DVDs), solid state drives, or other optical storage,magnetic cassettes, magnetic tape, magnetic disk storage or othermagnetic storage devices, or any other medium which may be used to storethe desired information and which may be accessed by the computingdevice 600. Any such computer storage media may be part of the computingdevice 600.

The computing device 600 may also include an interface bus 640 forfacilitating communication from various interface devices (for example,one or more output devices 642, one or more peripheral interfaces 644,and one or more communication devices 646) to the example basicconfiguration 602 via the bus/interface controller 630. Some of the oneor more output devices 642 include a graphics processing unit 648 and anaudio processing unit 650, which may be configured to communicate tovarious external devices such as a display or speakers via one or moreA/V ports 652. The one or more peripheral interfaces 644 may include aserial interface controller 654 or a parallel interface controller 656,which may be configured to communicate with external devices such asinput devices (for example, keyboard, mouse, pen, voice input device,touch input device, etc.) or other peripheral devices (for example,printer, scanner, etc.) via one or more I/O ports 658. An examplecommunication device 666 includes a network controller 660, which may bearranged to facilitate communications with one or more other computingdevices 662 over a network communication link via one or morecommunication ports 664. The one or more other computing devices 662 mayinclude servers, computing devices, and comparable devices.

The network communication link may be one example of a communicationmedia. Communication media may typically be embodied by computerreadable instructions, data structures, program modules, or other datain a modulated data signal, such as a carrier wave or other transportmechanism, and may include any information delivery media. A “modulateddata signal” may be a signal that has one or more of its characteristicsset or changed in such a manner as to encode information in the signal.By way of example, and not limitation, communication media may includewired media such as a wired network or direct-wired connection, andwireless media such as acoustic, radio frequency (RF), microwave,infrared (IR) and other wireless media. The term computer readable mediaas used herein may include both storage media and communication media.

The computing device 600 may be implemented as a part of a generalpurpose or specialized server, mainframe, or similar computer, whichincludes any of the above functions. The computing device 600 may alsobe implemented as a personal computer including both laptop computer andnon-laptop computer configurations.

Example embodiments may also include methods for linguistic analysisbased correlation of distinct events. These methods can be implementedin any number of ways, including the structures described herein. Onesuch way may be by machine operations, of devices of the type describedin the present disclosure. Another optional way may be for one or moreof the individual operations of the methods to be performed inconjunction with one or more human operators performing some of theoperations while other operations may be performed by machines. Thesehuman operators need not be collocated with each other, but each can beonly with a machine that performs a portion of the program. In otherembodiments, the human interaction can be automated such as bypre-selected criteria that may be machine automated.

FIG. 7 is a logic flow diagram illustrating a process for linguisticanalysis based correlation of distinct events, according to embodiments.

A process 700 may be implemented on a server. As described, a server mayinclude an analysis service. The computing device 600 may communicationwith the server through a network. A processing engine of the analysisservice may present configuration options on a user experience to theparticipant. The configuration options may include a modification of thecommunication and/or a modification of a comment associated with thecommunication. The user experience may be a visual display associatedwith the analysis service through which the participant may interactwith the analysis service.

The process 700 begins with operation 710, where the processing enginemay receive a communication associated with an incident from a user. Thecommunication may be in form of an instant messaging communication, anemail communication, a text message, an audio message, a video message,and/or a graphical message, among others. The communication may alsoinclude comments.

At operation 720, an analysis engine of the analysis service may performa linguistic analysis on a section of a comment. The section may includea sentence, a paragraph, or a user-defined section of the comment.

At operation 730, the analysis engine may determine a parameterassociated with a similarity of a keyword within the portion of thecomment to a predefined keyword. The trouble shooting ticket may then beas associated with the incident through a decision process based on theparameter at operation 740.

The analysis engine may analyze multiple trouble shooting ticketsemploying the decision process at operation 750. An alert may be issuedfor service outage at operation 760 in response to determining that anumber of trouble shooting tickets validated as associated with theincident exceeding a service outage threshold. The threshold may includea timing threshold and/or an urgency threshold associated with theincident, among others.

The operations included in process 700 are for illustration purposes.Linguistic analysis based correlation of distinct events may beimplemented by similar processes with fewer or additional steps, as wellas in different order of operations using the principles describedherein. The operations described herein may be executed by one or moreprocessors operated on one or more computing devices, one or moreprocessor cores, specialized processing devices, and/or general purposeprocessors, among other examples.

According to some examples, a server configured to assign acommunication to an incident is described. The server may include amemory configured to store instructions and a processor coupled to thememory, the processor configured to execute an analysis service. Theanalysis service may include a processing engine configured to receivethe communication associated with the incident, where the communicationincludes a comment. The analysis service may also include an analysisengine configured to perform a linguistic analysis on at least a portionof the comment; analyze a plurality of communications employing thedecision process; and in response to determining that a number ofcommunications validated as associated with the incident exceeding aservice outage threshold, issue an alert for the service outage. Thelinguistic analysis may include determining a parameter associated witha similarity of a keyword within the portion of the comment to apredefined keyword and validating the communication as associated withthe incident through a decision process based on the parameter.

According to other examples, the parameter may include one or morecriteria including a first criterion associated with a frequency ofcontextually-related keywords in the comment and a second criterionassociated with a usage frequency of the keyword in the comment, and theanalyzed portion may include a sentence or a paragraph in the one ormore comments. The analysis engine may be further configured to assign afirst weighted value to the first criterion; assign a second weightedvalue to the second criterion; and compare the first weighted value tothe second weighted value. The analysis engine may also be configured todetect the first weighted value as being greater than the secondweighted value; and compute a similarity score for the keyword withinthe analyzed portion of the comment based on the first criterionassociated with the keyword.

According to further examples, the analysis engine may be furtherconfigured to detect the first weighted value as being less than thesecond weighted value; and compute a similarity score for the keywordwithin the analyzed portion of the comment based on the second criterionassociated with the keyword. The analysis engine may also be configuredto receive a request to modify the assignment of one or more of thefirst weighted value to the first criterion and the second weightedvalue to the second criterion; identify a credential associated with arequesting party; and compare the credential to a predefined rule. Theanalysis engine may be further configured to detect a match between thecredential and the predefined rule; identify the requesting party as anadministrator; and provide an alert to be displayed on a user experienceto the requesting party to prompt the requesting party to modify theassignment associated with one or more of the first weighted value andthe second weighted value.

According to yet other examples, the analysis engine may be furtherconfigured to receive the modification of the assignment from therequesting party and execute modification of the assignment. Thedecision process may include comparison of the similarity score for thekeywords to a validation threshold and detection of the similarity scorefor the keyword as exceeding the validation threshold. The analysisengine may be further configured to identify the communication thatincludes the comment; detect a failure to validate an associationbetween the communication and the incident; analyze a history ofassociations of the communication to the incident and other incidentsduring a previous time period; and assign the communication to anotherincident based on the analysis.

According to other examples, a method to detect a service outage isdescribed. The method may include receiving a trouble shooting ticketassociated with an incident, where the trouble shooting ticket includesa comment; performing a linguistic analysis on a portion of the comment,where the linguistic analysis includes determining a parameterassociated with a similarity of a keyword within the portion of thecomment to a predefined keyword, and validating the trouble shootingticket as associated with the incident through a decision process basedon the parameter; analyzing a plurality of trouble shooting ticketsemploying the decision process; and in response to determining that anumber of trouble shooting tickets validated as associated with theincident exceeding a service outage threshold, issuing an alert for theservice outage.

According to some examples, employing the decision process may includecomputing a similarity score for the keyword within the portion of thecomment based on one or more criteria for comparing the keyword to thepredefined keyword; and comparing the similarity score for the keywordto a validation threshold. The method may further include selecting theplurality of trouble shooting tickets based on a predefined time period.The method may also include in response to determining that the numberof trouble tickets validated as being associated with the incident doesnot exceed the service outage threshold, adjusting the time period; andanalyzing another plurality of trouble shooting tickets based on theadjusted time period. The method may also include receiving a feedbackassociated with the validation; and adjusting a linguistic model usedfor the linguistic analysis based on the feedback. The threshold may bea timing threshold or an urgency threshold associated with the incident.

According to further examples, a computer-readable memory device withinstructions stored thereon to detect a service outage is described. Theinstructions may include receiving a trouble shooting ticket associatedwith an incident, where the trouble shooting ticket includes a comment;performing a linguistic analysis on a portion of the comment, where thelinguistic analysis includes determining a parameter associated with asimilarity of a keyword within the portion of the comment to apredefined keyword by computing a similarity score for the keywordwithin the portion of the comment based on one or more criteria forcomparing the keyword to the predefined keyword and validating thetrouble shooting ticket as associated with the incident based on theparameter by comparing the similarity score for the keyword to avalidation threshold; and in response to determining that a number oftrouble shooting tickets validated as associated with the incidentexceeding a service outage threshold, issuing an alert for the serviceoutage.

According to some examples, the comment may be in form of an instantmessaging communication, an email communication, a text message, anaudio message, a video message, or a graphical message. The instructionsmay further include assigning a first weighted value to a firstcriterion of the one or more criteria; assigning a second weighted valueto a second criterion of the one or more criteria; comparing the firstweighted value to the second weighted value; detecting the firstweighted value as being greater than the second weighted value; andcomputing the similarity score for the keyword based on the firstcriterion. The instructions may also include filtering the plurality oftrouble shooting tickets based on one or more of a geographical region,a datacenter, and a hosted service.

According to other examples, a means for detecting a service outage isdescribed. The means may include a means for receiving a troubleshooting ticket associated with an incident, where the trouble shootingticket includes a comment; a means for performing a linguistic analysison a portion of the comment, where the linguistic analysis includesdetermining a parameter associated with a similarity of a keyword withinthe portion of the comment to a predefined keyword and validating thetrouble shooting ticket as associated with the incident through adecision process based on the parameter; a means for analyzing aplurality of trouble shooting tickets employing the decision process;and in response to determining that a number of trouble shooting ticketsvalidated as associated with the incident exceeding a service outagethreshold, a means for issuing an alert for the service outage.

The above specification, examples and data provide a completedescription of the manufacture and use of the composition of theembodiments. Although the subject matter has been described in languagespecific to structural features and/or methodological acts, it is to beunderstood that the subject matter defined in the appended claims is notnecessarily limited to the specific features or acts described above.Rather, the specific features and acts described above are disclosed asexample forms of implementing the claims and embodiments.

What is claimed is:
 1. A method to detect a service outage, the methodcomprising: monitoring incoming and outgoing communications associatedwith one or more incidents, wherein the incoming and outgoingcommunications include communications between a user and a technicalsupport personnel or communications between two technical supportpersonnel; performing a linguistic analysis on at least a portion ofeach communication such that differently worded comments associated witha same incident are determined as being associated with the sameincident based on a determination of a similarity of a keyword withineach communication to a predefined keyword, wherein a linguistic modelused for the linguistic analysis is trained based on the monitoredincoming and outgoing communications; receiving one or more parametersassociated with a service outage alert, wherein the one or moreparameters include a service outage threshold, a service outagethreshold timing, and an alert recipient; and in response to determiningthat a number of the monitored incoming and outgoing communicationsdetermined as being associated with the same incident exceed the serviceoutage threshold, issuing the service outage alert based on the one ormore parameters.
 2. The method of claim 1, further comprising: selectingthe monitored incoming and outgoing communications based on a predefinedtime period.
 3. The method of claim 2, further comprising: in responseto determining that the number of the monitored incoming and outgoingcommunications determined as being associated with the same incidentdoes not exceed the service outage threshold, adjusting the time period;and analyzing another plurality of the monitored incoming and outgoingcommunications based on the adjusted time period.
 4. The method of claim1, wherein the service outage threshold is a timing threshold or anurgency threshold associated with the incident.
 5. The method of claim1, further comprising: filtering the monitored incoming and outgoingcommunications based on one or more of a geographical region, adatacenter, and a hosted service.
 6. The method of claim 1, furthercomprising: detecting a failure to associate a communication with theincident; analyze a history of associations of the communication withthe incident and other incidents during a previous time period; andassign the communication to another incident based on the analysis. 7.The method of claim 1, further comprising: associating a communicationwith an incident based on performing the linguistic analysis on aninitial portion of the communication; and providing one or morepotential solutions to an author of the communication based on theperformed linguistic analysis.
 8. The method of claim 1, furthercomprising: associating a communication with an incident based onperforming the linguistic analysis on an initial portion of thecommunication; and issuing an alert to a technical support personnelbased on the performed linguistic analysis on the initial portion of thecommunication.
 9. A server configured to detect a service outage, theserver comprising: a memory configured to store instructions; aprocessor coupled to the memory, the processor configured to: monitorincoming and outgoing communications associated with one or moreincidents, wherein the incoming and outgoing communications includecommunications between a user and a technical support personnel orcommunications between two technical support personnel; perform alinguistic analysis on at least a portion of each communication suchthat differently worded comments associated with a same incident aredetermined as being associated with the same incident based on adetermination of a similarity of a keyword within each communication toa predefined keyword, wherein a linguistic model used for the linguisticanalysis is trained based on the monitored incoming and outgoingcommunications; and in response to determining that a number of themonitored incoming and outgoing communications determined as beingassociated with the same incident exceed a service outage threshold,issue an alert for the service outage.
 10. The server of claim 9,wherein the monitored incoming and outgoing communications comprise aninstant messaging communication, an email communication, a text message,an audio message, a video message, or a graphical message.
 11. Theserver of claim 9, wherein the processor is further configured to:receive a request to modify an assignment of a monitored communicationfrom an incident to another incident; and in response to detecting amatch between a credential associated with a requesting party and apredefined rule, provide an alert to be displayed on a user experienceto the requesting party to prompt the requesting party to modify theassignment of the monitored communication from the incident to the otherincident.
 12. The server of claim 9, wherein the processor is configuredto perform the linguistic analysis based on: determination of a firstcriterion associated with a frequency of contextually-related keywordsin a monitored communication; determination of a second criterionassociated with a usage frequency of the keyword in the monitoredcommunication; and assignment of the monitored communication to anincident based on the first criterion and the second criterion.
 13. Theserver of claim 12, wherein the first criterion and the second criterionare applied to word within a single sentence or a single paragraph inthe monitored communication.
 14. The server of claim 12, wherein theprocessor is further configured to perform the linguistic analysis basedon: assignment of a first weighted value to the first criterion;assignment of a second weighted value to the second criterion; andcomparison of the first weighted value to the second weighted value. 15.The server of claim 14, wherein the processor is further configured to:upon detection of the first weighted value being greater than the secondweighted value, compute a similarity score for the keyword within theanalyzed portion of the monitored communication based on the firstcriterion associated with the keyword.
 16. The server of claim 14,wherein the processor is further configured to: upon detection of thefirst weighted value being less than the second weighted value, computea similarity score for the keyword within the analyzed portion of themonitored communication based on the second criterion associated withthe keyword.
 17. The server of claim 9, wherein the processor is furtherconfigured to: compare a similarity score for one or more keywords to avalidation threshold; and assign the monitored communication to anincident based on detection of the similarity score for the one or morekeywords as exceeding the validation threshold.
 18. A computer-readablememory device with instructions stored thereon to detect a serviceoutage, the instructions comprising: monitoring troubleshooting ticketsassociated with one or more incidents, wherein the monitoredtroubleshooting tickets include an instant messaging communication, anemail communication, a text message, an audio message, a video message,or a graphical message between a user and a technical support personnelor between two technical support personnel; performing a linguisticanalysis on at least a portion of each troubleshooting ticket such thatdifferently worded comments associated with a same incident aredetermined as being associated with the same incident based on adetermination of a similarity of a keyword within each troubleshootingticket to a predefined keyword, wherein a linguistic model used for thelinguistic analysis is trained based on the monitored troubleshootingtickets; and in response to determining that a number of the monitoredtroubleshooting tickets determined as being associated with the sameincident exceed a service outage threshold, issuing an alert for theservice outage.
 19. The computer-readable memory device of claim 18,wherein the incident is one or more of an event that causes aninterruption or a reduction in quality of a product or a service, afailure or an error associated with a software infrastructure, a failureor an error associated with a network, a failure or an error associatedwith a hardware, or a failure or an error associated with a software.20. The computer-readable memory device of claim 18, wherein thelinguistic analysis is performed on a comment included in thetroubleshooting ticket.